China: NPC requests public comments on second deliberated draft PIPL and draft data security law
The National People's Congress ('NPC') released, on 29 April 2021, the second deliberated drafts of the Personal Information Protection Law ('PIPL') and the Data Security Law and has requested public comments on the same. In particular, the second draft of the PIPL, among other things, expands on the right to withdraw consent, requiring that personal information processors provide a convenient method of withdrawing consent, noting that the withdrawal of consent by an individual does not affect the personal information processed before the withdrawal. In addition, the second draft of the PIPL addresses personal information of deceased individuals, specifically, highlighting that the exercise of their rights can be executed by close relatives. Furthermore, the second draft of the PIPL introduces requirements for internet platform services namely to:
- establish an independent organisation mainly composed of external members;
- cease providing services to products or service providers on the platform that hand personal information in serious violation of laws and administrative regulation; and
- regularly publish reports on social responsibility for personal information protection and accept social supervision.
On the other hand, the second draft of the Data Security Law requires the state to, among other things, establish a data classification and hierarchical protection system and categorise, as well as categorise data protection requirements based on the importance of the data. In addition, the second draft of the Data Security Law clarifies that the provision of the Cybersecurity Law applies to the security management of data collected or produced by critical information infrastructure operators inside mainland China.
Public comments can be submitted until 28 May 2021.